Pinger 1.0 - Remote Code Execution

Pinger 1.0 contains a remote code execution vulnerability that allows attackers to inject shell commands through the ping and socket parameters. Attackers can exploit the unsanitized input in ping.php to write arbitrary PHP files and execute system commands by appending shell metacharacters. id:...

Uptime-Kuma < v1.23.0 - Improper Access Control

Uptime-Kuma before v1.23.0 is vulnerable to an information disclosure issue due to missing authorization on the /api/badge/1/ping/24 endpoint. An unauthenticated attacker can access this endpoint to leak ping statistics, such as average ping and ping history, for existing monitors without needing...

CVE-2026-75108 Next Terminal Missing Per-Asset Authorization on Portal Endpoints

Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints, allowing any authenticated user to probe and wake assets they are not granted access to. Attackers can call these endpoints with arbitrary asset identifiers to retrieve asset information...

CVE-2026-72568

An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated attacker to cause denial of service or information disclosure by sending a specially crafted PING message to the Redis Cluster Bus port...

Redis 8.8.1 Heap Out-Of-Bounds Read

A proof of concept exploit for a heap out-of-bounds read vulnerability in Redis version 8.8.1. The vulnerability exists in Redis Cluster bus PING/PONG/MEET hostname extensions, where a hostname payload lacking a required NUL terminator can cause Redis to read beyond the end of the receive buffer...

CVE-2026-72568

Rejected reason: Red Hat CNA-LR concluded that this CVE is not valid...

UBUNTU-CVE-2026-72568

An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated attacker to cause denial of service or information disclosure by sending a specially crafted PING message to the Redis Cluster Bus port...

CVE-2026-72568

Rejected reason: Red Hat CNA-LR concluded that this CVE is not valid...

EUVD-2026-55238

An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated attacker to cause denial of service or information disclosure by sending a specially crafted PING message to the Redis Cluster Bus port...

CVE-2026-72568

...

CVE-2026-72568

Red Hat CNA-LR concluded this CVE is not valid; no patch, advisory, or technical details are present in any connected document, so this CVE ID is rejected/not used and does not represent an active vulnerability entry.

CVE-2026-72568

Red Hat CNA-LR concluded that this CVE is not valid...

CVE-2026-72568

...

CVE-2026-72568

Removed by vendor...

CVE-2026-71956

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a command injection vulnerability in the app.cgi interface. A remote attacker can inject arbitrary malicious commands into the netDig.ping.dst field, resulting in command execution with root privileg...

EUVD-2026-54808

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a command injection vulnerability in the app.cgi interface. A remote attacker can inject arbitrary malicious commands into the netDig.ping.dst field, resulting in command execution with root privileg...

CVE-2026-71956

CVE-2026-71956 affects D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044. The vulnerability is a command injection in the app.cgi interface that lets a remote attacker inject arbitrary commands into the netDig.ping.dst field, resulting in root-level comma...

CVE-2026-71946 D-Link DWR-M961 Command Injection via /boafrm/formPingDiagnosticRun

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formPingDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution...

CVE-2026-71946

D-Link DWR-M961 devices with hardware version C1 and firmware before 1.1.5_C1_202607071108 are affected by a command-injection vulnerability in the /boafrm/formPingDiagnosticRun interface. A remote attacker can inject commands into the host field, achieving root-level command execution. Remediati...

Malicious code in @activepieces/piece-google-contacts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e200ba4f9d11d42636dbbd1fa698843321af8b0bd23ff63493c0ce94891a5cb src/index.js imports childprocess and issues POST requests alongside a ping command invocation lines 25, 38, 49. The co-occurrence of childprocess...